CVE-2026-107770: Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

Q: Who can exploit this issue?

Unauthenticated attackers can invoke the affected endpoint to delete arbitrary media attachments or upload new attachments. The described token exposure also allows a Subscriber-level user to obtain their own wplr_auth_token from the profile.php page source and use it from a cookie-less HTTP session.

Q: What capabilities can an attacker gain through the affected actions?

An attacker can permanently delete arbitrary media attachments through wp_delete_attachment and upload new attachments to the site. These actions normally require the upload_files or edit_others_posts capabilities.

Q: Which endpoint and actions are involved?

The affected endpoint is /?wplr-sync-api. The described destructive and upload operations use the delete and sync actions.

Q: How can administrators assess whether their installation is in scope?

Installations running Photo Engine versions up to and including 6.5.6 are described as affected. The token exposure can be checked by determining whether a Subscriber can view their wplr_auth_token in the source of profile.php.

Published Oct 16, 2026

Updated

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wpdeleteattachment and upload new attachments to the site, actions that require the uploadfiles or editothersposts capabilities. A Subscriber-level user can obtain their own wplrauthtoken directly from the profile.php page source, because the admin screen guard in MeowWPLRSyncAdmin::construct() is commented out, causing wplocalizescript to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.

Affected Software

1 affected component

Meow Apps Photo Engine (Media Organizer & Lightroom)<=6.5.6

Event History

Oct 16, 2026

CVE Published

via MITRE·06:41 AM

Data Sourced

via MITRE·06:41 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can invoke the affected endpoint to delete arbitrary media attachments or upload new attachments. The described token exposure also allows a Subscriber-level user to obtain their own wplr_auth_token from the profile.php page source and use it from a cookie-less HTTP session.

What capabilities can an attacker gain through the affected actions?

An attacker can permanently delete arbitrary media attachments through wp_delete_attachment and upload new attachments to the site. These actions normally require the upload_files or edit_others_posts capabilities.

Which endpoint and actions are involved?

The affected endpoint is /?wplr-sync-api. The described destructive and upload operations use the delete and sync actions.

How can administrators assess whether their installation is in scope?

Installations running Photo Engine versions up to and including 6.5.6 are described as affected. The token exposure can be checked by determining whether a Subscriber can view their wplr_auth_token in the source of profile.php.

CVE-2026-107770: Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What capabilities can an attacker gain through the affected actions?

Which endpoint and actions are involved?

How can administrators assess whether their installation is in scope?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capabilities can an attacker gain through the affected actions?

Which endpoint and actions are involved?

How can administrators assess whether their installation is in scope?